AuthSecured

AuthSecured 1.2.6

Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41.

What's new

- /authadmin doctor now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in restrictions.allowed-commands, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable.

Contributors

A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - /authadmin resetpassword and /authadmin unregister now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example /l) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in.

Fabric compatibility

- The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an ALTER TABLE players MODIFY COLUMN error.

Notes

- No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

AuthSecured 1.2.5 Fabric Compatibility Fix

Recommended for Fabric servers that also run Ledger. Paper is unchanged.

Fixes

- Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an ALTER TABLE players MODIFY COLUMN error.

Notes

- No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

AuthSecured 1.2.4 Security & Reliability Update

Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit.

Security fixes

- The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - /authadmin resetpassword now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names.

Reliability fixes

- Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - /authadmin unlock and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - /logout now ends every active session for the account, not only the most recent one. - Fabric's /login, /register and /changepassword now accept the same password characters Paper already does, with no need to quote special characters.

Maintenance

- Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login /changepassword issue fixed in 1.2.3. - /authadmin doctor now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret.

Notes

- No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

AuthSecured 1.2.3 Security Update

Recommended for every server. This release closes pre-login bypasses found in a security audit.

Added

- Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3.

Security fixes

- /changepassword can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as /login. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (/msg, /me, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication.

Changes

- Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by restrictions.freeze-player (enabled by default).

Fixes

- PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the max-accounts-per-ip registration limit. - Spigot: all pre-login restrictions now load, and /authadmin resetpassword no longer needs Paper-only APIs.

Notes

- No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

AuthSecured 1.2.2 Security Update

Security fixes

- A private AUTHSECURED_IP_SECRET is now required. Servers without it keep authentication blocked until it is configured. - Unknown player IP addresses no longer share one rate-limit identity or create IP-bound reconnect sessions. - Malformed Argon2id hashes cannot request excessive memory or work factors. - SQLite foreign keys now enforce session deletion when an account is removed. - Optional Redis fallback is visible in /authadmin doctor. Set redis.required: true to stop authentication when shared Redis is unavailable. - Discord alerts accept official HTTPS webhook endpoints only.

Reliability and maintenance

- Expired sessions and old audit entries are cleaned periodically outside the server thread. - Configure logging.audit.retention-days and logging.audit.cleanup-interval-seconds in config.yml. - SQLite now records its schema version and safely upgrades existing databases. - Internal errors produce useful, privacy-safe diagnostics.

Packaging

- Updated dependencies after a vulnerability scan. - Reduced shaded JAR size and isolated bundled JSON libraries. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version.

Performance

- High-frequency events (movement, interactions, commands) now use cached configuration values, significantly reducing string parsing and lookup overhead.

Bug Fixes & Stability

- Intercepted password-bearing commands are now executed directly to prevent double-logging and reliably bypass other command-logging plugins. - Added graceful degradation if the sensitive command log filter fails to install: the server securely blocks new logins and kicks players instead of erroring on startup. - Asynchronous player kicks and messages are now properly scheduled to run on the main server thread.

Compatibility & Quality of Life

- Upgraded internal player messaging and kicks to use the modern Adventure Component API for broader Paper compatibility. - Added explicit folia-supported: false to plugin.yml. - Added a security reminder for administrators to clear their chat history (F3 + D) after generating a temporary password via /authadmin resetpassword.

AuthSecured 1.2.1 Security Update

Security fixes

- Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout.

Administration improvements

- Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active.

Reliability

- Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

New administration tools

- Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions.

Authentication and security

- Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots.

Compatibility

- Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

Added

- Always-on redaction of password arguments from Fabric command diagnostics, profiler labels, and debug exception logs. - Validation bounds for security, database, Redis, rate-limit, and session numeric settings, plus PostgreSQL ssl-mode support.

Fixed

- Fabric now stays fail-closed when core initialization fails, blocks flight according to restrictions.allow-flight, and ignores stale asynchronous join callbacks after a disconnect or rapid reconnect. - Invalid YAML reloads retain the last valid configuration snapshot.

Changed

- Configuration lookups now use an immutable flattened snapshot, reducing work in high-frequency movement and packet restriction checks. - config.yml now documents every active option, accepted values, units, reload behavior, environment variables, and security-sensitive defaults.

Added

- Shared platform bootstrap so Paper and Fabric use identical password policy, localization, rate limiting, sessions, SQLite/PostgreSQL, and Redis behavior. - Full version-matrix build and compatibility checks.

Fixed

- Session IP verification now rejects reconnects from a different address. - Non-persistent sessions remain in memory and no longer survive restarts. - Logout revokes the active session. - /register validates password confirmation. - Paper listeners and commands now share one restriction-state manager. - Database integration tests are included in the standard build. - SQLite now loads correctly from the packaged Fabric and Paper JARs.

Installation notes

- Paper, Purpur, Spigot, or Leaf: use authsecured-paper-1.1.0.jar in plugins/.

Removed

- Complete removal of Fabric module (platform-fabric), Fabric Loader dependencies, Fabric API listeners, Brigadier registrations, and Mixin configurations (architectural decision to maintain Fabric as a standalone repository). -

Changed

- Transitioned repository build system to a Paper/Purpur-focused architecture (:core, :database, :platform-paper). - Updated build_and_test.sh to compile core/database/paper modules and generate single authsecured-paper-1.0.3.jar artifact. - Cleaned up docstrings across core ports [AuthPlatform], [PlatformLogger], [PlayerRestrictionAdapter]

Added

- Specialized Paper, Purpur, Spigot, and Leaf high-performance Minecraft server architecture. - Multi-language localization system with 5 language bundles: English (messages_en.yml), Russian (messages_ru.yml), Spanish (messages_es.yml), Italian (messages_it.yml), and French (messages_fr.yml). - Chat message color customization (&0-&f, &l, &o, etc. -> §), customizable command usage labels, and automatic English fallback. - Fully customizable session configuration (session.timeout-seconds, session.enabled, session.verify-ip, session.persistent). - Admin session management subcommands (/authadmin session gettimeout and /authadmin session settimeout <seconds>). - Granular unauthenticated player action restrictions in config.yml (freeze-player, allow-flight, block-chat, block-commands, allowed-commands, block-inventory, block-interactions, block-block-break, block-block-place, block-damage-taken, block-damage-dealt, block-item-drop, block-item-pickup, block-hunger).

Fixed

- Robust exception handling across all asynchronous futures, event listeners, and administrative command handlers. - Safe password character array clearing in memory on both success and error execution paths.

Added

- Fabric Dedicated Server support (fabric.mod.json and AuthSecuredFabricMod entrypoint) for multi-platform deployment on Fabric, Paper, and Purpur servers.

Fixed

- Fixed SQL column mapping mismatch (server_id vs serverId) in DatabaseSessionRepository. - Fixed RedisRateLimitStore initialization in DependencyContainer to instantiate JedisPool when Redis is enabled, and gracefully close connection pool on shutdown. - Fixed session invalidation in /logout command to revoke active database sessions. - Fixed potential NullPointerException race condition in MemoryRateLimitStore and added expiration key cleanup to prevent memory leaks. - Fixed countAccountsByIpHash in SQLite & PostgreSQL repositories to accurately count registered accounts from security_events (REGISTER_SUCCESS). - Fixed potential NullPointerException when calling player.getAddress() across commands by adding safe IP fallback (0.0.0.0). - Fixed /authadmin reload behavior to reload YAML configurations and refresh active settings.

Changed

- Removed duplicate Groovy build files (build.gradle, settings.gradle) in favor of clean Gradle Kotlin DSL (build.gradle.kts, settings.gradle.kts). - Updated release version to 1.0.1.

Added

- Initial release of AuthSecured plugin. - Hexagonal Architecture & Clean Separation. - Argon2id password hashing with BouncyCastle provider. - Dual database support: PostgreSQL & SQLite with Flyway migrations. - Rate limiting for per-account & per-IP abuse prevention. - Pre-auth restriction system for Paper & Purpur. - Integration test suite for SQLite and unit test suite.